# Digital Asset Links Configuration

This file enables Trusted Web Activity (TWA) verification for the Placebo.mk Android app.

## What is this?

Digital Asset Links allows your Android app to open without browser UI by proving you own both the website (`https://app.placebo.mk`) and the Android app (`mk.placebo.app`).

## Current Status

⚠️ **PLACEHOLDER** - The SHA256 fingerprint needs to be updated after PWABuilder generates your signing key.

## How to Update

### Step 1: Generate Android App with PWABuilder

1. Go to https://www.pwabuilder.com/
2. Enter your PWA URL: `https://app.placebo.mk`
3. Click "Package For Stores" → "Android"
4. Download the package

### Step 2: Get SHA256 Fingerprint

PWABuilder will provide the SHA256 fingerprint in the downloaded package. Look for:
- `assetlinks.json` file in the package
- Or in the PWABuilder dashboard under "Android Package Options"

The fingerprint looks like:
```
14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:16:A0:83:42:E3:6D:3A:AE:4E:9F:5F:E8:E3:91:A0:7E
```

### Step 3: Update assetlinks.json

Replace `PLACEHOLDER_SHA256_FINGERPRINT_FROM_PWABUILDER` in `assetlinks.json` with your actual fingerprint:

```json
{
  "relation": ["delegate_permission/common.handle_all_urls"],
  "target": {
    "namespace": "android_app",
    "package_name": "mk.placebo.app",
    "sha256_cert_fingerprints": [
      "14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:16:A0:83:42:E3:6D:3A:AE:4E:9F:5F:E8:E3:91:A0:7E"
    ]
  }
}
```

### Step 4: Deploy Updated File

The file must be accessible at:
```
https://app.placebo.mk/.well-known/assetlinks.json
```

Nginx is already configured to serve this file (see `nginx.conf`).

### Step 5: Verify

Use Google's validator tool:
```bash
curl "https://digitalassetlinks.googleapis.com/v1/statements:list?source.web.site=https://app.placebo.mk&relation=delegate_permission/common.handle_all_urls"
```

Or visit:
https://digitalassetlinks.googleapis.com/v1/statements:list?source.web.site=https://app.placebo.mk

You should see your statement returned with `"debugString": "*** ERRORS parsing assetlinks.json: ..."` until you replace the placeholder.

## Troubleshooting

### File not accessible
- Check nginx configuration includes `.well-known` location
- Verify file permissions (should be readable)
- Test with: `curl https://app.placebo.mk/.well-known/assetlinks.json`

### TWA not opening properly
- Ensure SHA256 fingerprint matches your app's signing certificate
- Verify package name is exactly `mk.placebo.app`
- Check both production and debug fingerprints if testing locally

### Multiple Fingerprints

If you have both debug and release keys, add both:
```json
"sha256_cert_fingerprints": [
  "14:6D:E9:... (release key)",
  "AA:BB:CC:... (debug key)"
]
```

## Important Notes

- This file must be served with `Content-Type: application/json`
- The file must be accessible via HTTPS (HTTP will fail)
- Changes take effect immediately (no cache)
- Keep your signing key secure - anyone with it can create apps verified for your domain

## Resources

- [Digital Asset Links Documentation](https://developers.google.com/digital-asset-links/v1/getting-started)
- [TWA Guide](https://developers.google.com/web/android/trusted-web-activity)
- [PWABuilder Documentation](https://docs.pwabuilder.com/)